IT Systems Engineer · Security Automation

Kyle Welch

HIPAA + FISMA regulated environments

I build security programs from zero and ship production AI-augmented IT tooling — the kind a résumé bullet undersells.

1,358endpoints secured
34%attack-surface reduced
700+hidden findings surfaced
$15–60K/yr tooling replaced

About

I'm an IT systems engineer with 6+ years in IT across regulated healthcare and federal environments. My specialty is the unglamorous, high-trust work: walking into an environment with no structured security program and leaving behind one that's documented, defensible, and audit-ready — without a team and without a budget for new tooling.

The throughline started with active-duty U.S. Army service, where systematic risk analysis, precision under pressure, and documentation discipline weren't habits — they were the job. I carried that into federal IT at the USDA (FISMA / NIST, vulnerability management, M365 migrations for a 1,400-user workforce), then into a multi-site regional healthcare clinic, where I stood up the HIPAA security program solo over eleven months: 80+ documented milestones, endpoint protection across 1,000+ devices, and an "Exceeds Standards" rating at the four-month mark.

That same instinct scales past tooling: I've led two multi-site platform migrations end to end — a Cisco voice stack and a helpdesk consolidation — owning discovery, dependency mapping, compliance gates, and cutover design across the fleet.

Lately the same instinct has turned toward AI-augmented delivery — production CISA KEV vulnerability automation and LLM-maintained knowledge systems running against real fleets in a regulated environment. Not proofs of concept. Things that ship and get used.

Focused on security automation, regulated IT, and AI-augmented operations — building systems that make complex environments more visible and defensible.

The first 90 days, every time

Find the gaps

A full software inventory and CISA KEV–prioritized vulnerability picture lands in weeks, not quarters.

Automate the toil

Manual, error-prone security ops become safe-by-default, idempotent, audit-ready automation.

Document for auditors

What I leave behind is defensible, HIPAA/NIST-mapped evidence that holds up when someone comes asking.

"You've been a great addition to our team — starting strong and continuing to impress."

— IT manager, four-month performance review

Flagship Work

Production systems built solo — and multi-site platform migrations led end to end. Proof of execution, not promise.

Production CVE Scanner

Production vulnerability management automation + open-source clean-room release

1,358endpoints
102Ksoftware records
30+production releases

A vulnerability scanner that inventories software across the entire managed fleet in a single bulk query, classifies every finding against the NIST NVD, ranks by CVSS score and CISA Known Exploited Vulnerabilities status, and runs weekly, unattended — publishing an executive KEV/SLA exposure report that doubles as the HIPAA audit record. It replaced $15–60K/yr of commercial tooling, surfaced 700+ previously-invisible High and Critical findings on its first run, and drives real remediation — not just detection.

Open source · v1.0.0 · Apache-2.0

fleet-cve-scanner is the sanitized, clean-room PowerShell 7 port of this production lineage — released with native REST, offline CSV input, cross-platform CI, eight test suites, and candid documentation of where CPE-based scanning can be wrong.

View on GitHub ↗

Engineering detail

Orchestrates two custom Go CLIs (generated from OpenAPI specs via an "OpenAPI-to-CLI printing-press" pattern) under PowerShell 7.
Two-gate NVD rate limiter solving an undocumented vendor constraint (≈600 ms minimum inter-request spacing + sliding-window bucket).
7-day NVD result cache cut repeat-run time from ~12 hours to minutes.
MSRC OS-patch correlation auto-resolves UNKNOWN Microsoft findings against ~99k installed-patch records per scan (UNKNOWN → PATCHED).
8-gate release pipeline (AST parse, smoke scan, HIPAA CSV-schema/PHI guard, finding-count sanity band, version+changelog, hash-verified push) backed by a 32-assertion test suite.
Git-tracked triage workflow (accepted-risk / monitoring / false-positive) plus operator-curated suppression so the report reflects real exposure, not noise.
Remediation runbooks + deployable update scripts cleared high-CVSS findings (7-Zip, Realtek audio driver, VSTA 2019).
Governance enforcement reduced the managed software catalog ~34% — a direct cut to fleet attack surface.
Closed-loop: auto-publishes findings to the internal IT wiki on every run (HIPAA §164.308 audit trail).

PowerShell 7
Go
NIST NVD API
CISA KEV
OAuth2
OpenAPI

LLM-Maintained IT Knowledge Wiki

Enterprise AI rollout — reference implementation in a regulated environment

~228pages, 2 wikis
~3 wkssolo, init → prod
8page templates

An internal IT knowledge base that an LLM maintains under human approval gates — spanning infrastructure, clinical systems, security/HIPAA, and vendor management. Architected the schema, the template library, the workflows, and the multi-agent tooling from scratch. HIPAA discipline is encoded at the schema level: no PHI, ever, enforced at every ingest gate.

Engineering detail

8 page-template library (system, vendor, runbook, security, incident, concept, comparison, question) with frontmatter contracts and enforced body structure.
3 explicit workflows — INGEST / QUERY / LINT — each with a "propose, then wait for human approval" gate.
Vendor-agnostic multi-agent schema (works with Claude Code and Codex); skills and conventions accrue in the repo.
Static, self-contained dashboard generator (~1 MB HTML) for executive demos without granting wiki access.
Spun the same engine into a 52-page HIPAA Security & Compliance KB mapping all 26 Security Rule specifications to implementation status, with SRA remediation and vendor-BAA tracking.
Closed-loop with the CVE Scanner — making the wiki the canonical security audit trail.

Claude Code
Codex
Markdown / Obsidian
Python
PowerShell
git

Internal MCP Knowledge Service

Self-hosted RAG for coworkers' AI agents — no embeddings, no vector database

494docs served
9/9acceptance benchmark
0embeddings, 0 cloud calls

Built and shipped a single-host service that serves an organization's markdown knowledge corpus to coworkers' AI coding agents over MCP — search, read, list — with no embeddings, no vector database, and no cloud dependency. Keyword retrieval done carefully beat the reflex to reach for a vector store, at a fraction of the operating cost and attack surface. The acceptance benchmark was written and recorded before the server existed, so the implementation could not be tuned to the test.

Engineering detail

Retrieval without a vector store. Python FastMCP server over streamable HTTP, building an in-memory SQLite FTS5 index at startup — no on-disk index state, so a refresh is "swap the corpus and restart" and losing the host costs only a rebuild.
Raw text never reaches the query engine. Input is tokenized, stop-listed, and recombined as OR'd unigrams plus adjacent-pair phrases, with bm25 weighting path and title heaviest. That alone scored 9/9 — no embeddings required.
Fail-closed build pipeline. Verify pinned source SHA → enumerate → ID-collision gate → stage → secret scan → file-count floor → hash manifest → atomic swap. One previous generation is retained for instant rollback, and a failed gate never touches production.
A secret scanner that knows a value from a name. It distinguishes a live secret from a variable name or vault reference; allowlisting is opt-in and only suppresses the build failure — waived hits are still scrubbed to a redaction placeholder.
Read-only by construction. Three tools, zero write surface. Bearer-token auth via constant-time compare in ASGI middleware; the unauthenticated health endpoint returns a document count and nothing else; TLS from an internal CA; path containment rejects UNC, drive-letter and .. escapes.
Auditable by design. The corpus is pinned to a source-control SHA, so "what the service knows" is a reproducible, reviewable statement rather than a guess.
Adversarial plan review before a line was written — a second frontier model attacked the design and returned 60 findings; 22 were adopted and the rest rejected as disproportionate, with the scope-control reasoning documented rather than silently dropped.
Handed over on a gated release ending in a receiver sign-off drill: the receiving admin runs every DR and ops drill unaided, and any gap found is treated as a runbook bug rather than a trainee failure.

Python
FastMCP
MCP
SQLite / FTS5
ASGI
TLS / internal CA
git

Engineered Departure Handoff

Treating "the successor can run it without me" as a claim that must be proven

13projects handed over
3independent reviewers
Coldsuccessor runs it from docs

Built the departure handoff for an entire IT project portfolio as an engineered, testable system rather than a document dump. Every project got the same guide structure, and the whole package was reviewed against the actual code before it was handed over. The verdict from three independent reviewers: a successor could operate every project cold, from the documentation alone.

Engineering detail

One repeated guide template across all 13 projects — executive overview, fundamentals primer written for someone who has never seen the platform, architecture, operations runbook, gotchas, troubleshooting by symptom, FAQ, deferred work, and ownership/tribal knowledge, ending in a fill-in transition checklist.
Staleness managed, not denied. A single dated STATE file for the whole portfolio carries the explicit precedence rule "newest dated statement wins"; guides override their own stale planning docs and say so inline.
The sign-off is a drill, not a signature. The receiving admin runs every DR and ops procedure unaided — and any gap found is logged as a runbook bug, never as a trainee failure.
Unknowns are written as unknowns. Guides flag their own stale sections and record open questions as blank-owner action items rather than guessing, so the reader can tell knowledge from assumption.
Review surfaced that the residual risk was organizational, not documentation — unnamed successors, and credentials tied to a personal account that would fail silently at offboarding. Those became the first items in each new owner's queue.
Consistent engineering signature across the portfolio: dry-run by default, multi-gate destructive actions, fail-loud exit codes for unattended jobs, and adversarial review before automating anything.

Runbook design
DR drills
Technical writing
Knowledge transfer
git

Voice Platform Migration

Project lead — multi-site Cisco UC discovery & extraction

1,390phones
~11sites
100%911 routing mapped

Led discovery and extraction of a full enterprise Cisco voice / UC stack (call manager, contact center, voicemail) ahead of migration — pulling 1,390 phones, 1,234 users, and 224 route patterns into a structured config baseline, mapping the multi-site dial plan and safety-critical per-site emergency 911 routing, and surfacing undocumented dependencies before anyone touched production.

Engineering detail

Extracted 100 config tables + 9 SIP normalization scripts; full export of phones, users, directory numbers, route patterns, and gateways.
Mapped the multi-site dial plan and emergency 911 routing — life-safety scope — plus a call-flow seed index from 128 contact-center entry points.
Surfaced undocumented dependencies (EMR-driven fax, paging, SIP border elements, carrier path, legacy PBX) that would otherwise have broken at cutover.
Pre-migration safety snapshot caught a backup failing ~28 days as an independent data-loss risk.
AI-assisted parsing + structured phase planning produced a reusable, click-by-click migration playbook.

Cisco voice / UC
Dial plan
Emergency 911
SIP
AI-assisted parsing

Helpdesk Platform Consolidation

Project lead — legacy helpdesk → RMM, hard cutover in a HIPAA environment

BAAapproved
SSO + SCIMleast-privilege
5-phasecutover plan

Led the consolidation of a separate legacy helpdesk platform into the RMM — authoring the project charter, requirements, and a 5-phase roadmap, and driving a vendor BAA through compliance to Privacy-Officer approval to clear the HIPAA gate before any data moved.

Engineering detail

Designed SSO + SCIM auto-provisioning with least-privilege end-user accounts (SAML, directory sync).
Stood up foundational configuration and bulk device-owner assignment automation.
Ran a migration research spike and produced the reference/training doc set for the cutover.
Method: AI-driven phase planning, requirements structuring, and research synthesis.

SAML SSO
SCIM
BAA / HIPAA
RMM
Phase planning

Data Classification Policy v1.0

Authored the org's first formal data-classification framework — four tiers (Public / Internal / Confidential / Restricted-PHI) mapped to HIPAA, HITECH, Minnesota health-records law, and PCI DSS. Gates AI and M365-connector rollout on policy, not guesswork.

Windows 11 25H2 Ring Program

Management-approved ring-based migration program for several hundred patient-facing endpoints — preflight validation, OEM-specific policies, and PowerShell enablement/force-upgrade automation against an October 2026 deadline.

Endpoint Protection Standardization

Brought 1,000+ endpoints to the current EDR generation and gave ~50 servers updated or first-ever coverage, with a safety script that only enables OS-native passive mode after the primary AV is confirmed.

Selected Projects

Range beyond the day job — full-stack, AI systems, and infrastructure I build and run myself.

Genome

Privacy-First Genomics Platform

Built a full-stack genetic analysis platform that turns raw consumer DNA files into evidence-weighted health, training, supplement, and protocol insights. Raw 23andMe files are parsed entirely in-browser in a Web Worker; the raw genotype file never reaches the server — only a manifest-filtered subset of health-relevant variants is uploaded.

13-phaseproduct roadmap
RLStenant isolation
On-deviceDNA parsing

React 19
FastAPI
PostgreSQL
Redis
Clerk
RLS
Web Workers
Claude API

Engineering detail

Built React / FastAPI / Postgres architecture for personalized genetic analysis and protocol generation.
Implemented authentication and per-user isolation with Clerk and Postgres row-level security.
Re-architected upload flow so raw genotype parsing happens client-side, with only derived results stored.
Designed recommendation framing around evidence tiers, safety flags, and “not medical advice” compliance language.
Roadmapped production hosting, Stripe tier enforcement, privacy/legal controls, and iOS packaging.

Hermes / Ethel

Always-On AI Operating System

Built and operate a Telegram-accessible AI operating system with persistent memory, project-aware agents, scheduled jobs, tool access, filesystem workflows, and multi-model delegation. The system runs as real infrastructure, not a demo: it coordinates portfolio strategy, personal knowledge workflows, cron-based briefings, and project execution through specialized agents.

24/7agent runtime
Telegramcommand surface
MCP + toolsexecution layer

Hermes Agent
Telegram Bot
MCP
Python
Cron
Skills
Persistent Memory
Multi-Agent Ops

Engineering detail

Built a multi-agent operating model with separate agents for personal intake, strategic portfolio management, and project execution.
Wired persistent memory, skills, scheduled jobs, local filesystem access, project repos, and Telegram delivery into daily use.
Uses agent-specific boundaries: personal front door, portfolio CEO, reflection/oracle functions, and specialized project workflows.
Runs autonomous cron jobs for recurring status, reflections, backups, and operational monitoring.
Demonstrates production AI operations: tool permissions, context boundaries, memory hygiene, scheduled execution, and human review gates.

Yggdrasil — Homelab Dashboard

Single-pane-of-glass for a multi-hypervisor homelab: unifies UniFi, Unraid, Proxmox, TrueNAS, and AI-token metrics in real time. Async polling, SSE, SQLite history — full-stack ops.

FastAPI
Vanilla JS
Docker
SSE

PYTHIA Monitor

Always-On World Monitor — and the forecaster I retired

Watches 14 live public feeds across AI, cybersecurity, geopolitics, US healthcare regulation, and markets, detects what actually changed, and delivers one cited brief to my phone each morning. It began as a multi-model forecasting swarm — which I measured, found a trivial base rate beat roughly fourfold, and retired. The monitor is what the evidence said to build instead.

14verified live feeds
$0.008per daily brief
262tests

Python
SQLite / WAL
Docker
Proxmox
ntfy
OpenRouter

Engineering detail

No LLM touches change detection. NEW / CHANGED / GONE deltas are computed in code, so the same inputs always produce the same deltas; the model only rewrites the result into prose.
The brief is cited or it does not ship. A hard citation gate takes every source URL from the evidence store, never from the model, and a monthly spend cap is enforced in code.
Every feed was verified with a real call before adoption, and every rejection is recorded with its evidence — expired endpoints, terms that forbid the use, robots exclusions — so nobody re-researches a dead end.
Durable event spine: stable observation identity that excludes volatile fields, stories with revision history, one-year retention, and health reporting that distinguishes "feed down" from "no news".
Shipped on the second attempt, by design. An adversarial review returned DO-NOT-SHIP after finding that one bad adapter could silently empty the feed registry while the health endpoint still reported every feed healthy. Fixed, then re-gated by a fresh reviewer.
Delivery is confirmed by polling the notification service itself — the send call's own success status had already lied once.

Stellar Notes

Privacy-First Voice Intelligence

Built and use a cross-platform voice-notes system that turns recordings into searchable transcripts and structured summaries. Sensitive work-mode notes stay on-device; cloud transcription and summaries are explicit per-note opt-ins. A shared TypeScript core powers iOS, macOS, and Windows without an application backend.

Stellar Notes desktop console beside the iOS recording screen

3 platformsiOS · macOS · Windows
0 backendlocal-first architecture
FTS5spoken-word search

React Native
Electron
TypeScript
SQLite / FTS5
Apple Speech
Ollama
whisper.cpp

View public showcase ↗

Engineering detail

Shares a TypeScript core, SQLite schema, and migration chain across React Native and Electron while keeping platform-native audio engines behind one contract.
Work Mode is a per-note privacy boundary: once enabled, it aborts active cloud work, clears cloud opt-in, and forces subsequent transcription and summarization on-device.
Runs local ASR through a validated stdio sidecar contract spanning Apple Neural Engine, Parakeet, and whisper.cpp implementations.
Normalizes cloud and on-device summaries to the same schema for key points, actions, decisions, and open questions.
Keeps cloud credentials in the OS keychain and exposes the architecture through a curated public repository with screenshots and selected load-bearing code samples.
iOS is deliberately dormant, and that was the right call. The mobile app was built and working; I let its signing certificate lapse once the desktop build became my daily driver. Capture happens in two lanes only — meetings at a desk and calls at the Mac — so mobile was scoped out on evidence rather than maintained on principle. The shared core still targets all three platforms; only the iOS build is parked.

+ more

A production PowerShell automation suite (safe-by-default, idempotent, concurrent-safe, HIPAA-cited), identity governance tooling, and a self-hosted infrastructure stack. Happy to walk through any of it.

Skills & Credentials

Security Operations

EDR (Cisco Secure Endpoint)
Vulnerability Management
CISA KEV
CVSS prioritization
Incident Response
Tenable
MITRE ATT&CK

Identity & Access

Active Directory
Entra ID / M365
Conditional Access
SSO / RBAC
Privileged Access (PAM)
Intune

Automation & Tooling

PowerShell 7
Go
Python
REST / OpenAPI
RMM automation
IT documentation
Microsoft Graph

AI-Augmented IT

Claude Code (production)
MCP
LLM-maintained wikis
Prompt engineering at scale
AI governance (HIPAA/BAA)

Compliance & Governance

HIPAA Security Rule (§164.308/310/312)
NIST
FISMA
BOD 22-01
Data Classification (HIPAA/PCI)
Audit-ready documentation

Certifications

CompTIA Security+
CompTIA A+
ITIL Foundation
Barracuda SAT01
U.S. Army Veteran
10-pt Veterans Preference

Get in touch

Building out a security or IT engineering team in a regulated environment? I'd like to hear about it. Résumé available on request — just email me.